CompTIA Network+ Network+ Network Security 2 — Questions and Answers
Question 1: Which attack sends unsolicited ARP replies to poison a host's ARP cache and redirect traffic?
- DNS spoofing
- ARP poisoning (Correct answer)
- MAC flooding
- VLAN hopping
Correct answer: ARP poisoning
ARP poisoning (ARP spoofing) sends gratuitous ARP replies to associate an attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.
Question 2: What is the primary purpose of a honeynet?
- Filter malicious traffic before it reaches production systems
- Lure attackers into an isolated environment to study their techniques (Correct answer)
- Encrypt data in transit between network segments
- Balance load across multiple security appliances
Correct answer: Lure attackers into an isolated environment to study their techniques
A honeynet is a network of honeypots designed to attract attackers and gather intelligence on their tools and methods.
Question 3: Which protocol provides mutual authentication and encrypts 802.1X EAP exchanges using TLS tunnels?
- EAP-MD5
- LEAP
- PEAP (Correct answer)
- EAP-FAST
Correct answer: PEAP
PEAP (Protected EAP) wraps EAP in a TLS tunnel, providing server authentication via certificate and protecting inner EAP credentials.
Question 4: A company wants to prevent users from accessing social media during work hours. Which security control is BEST suited?
- IDS signature update
- Content/URL filtering (Correct answer)
- NAC health check
- Port security on switches
Correct answer: Content/URL filtering
Content/URL filtering (typically via a proxy or next-gen firewall) inspects URLs and blocks access to categories like social media.
Question 5: In the context of firewalls, what does a stateful inspection firewall track that a basic packet filter does not?
- Application layer payloads
- The state of active TCP/UDP connections (Correct answer)
- User identity and role
- Encrypted VPN tunnels
Correct answer: The state of active TCP/UDP connections
Stateful inspection firewalls maintain a connection state table to verify that incoming packets belong to an established or related connection.
Question 6: Which wireless security attack exploits the TKIP implementation in WPA to recover keystream bytes?
- Evil twin attack
- TKIP MIC exploit (Beck-Tews) (Correct answer)
- KRACK
- Deauthentication flood
Correct answer: TKIP MIC exploit (Beck-Tews)
The Beck-Tews attack exploits weaknesses in WPA's TKIP MIC (Michael) algorithm to inject short packets and recover keystream.
Question 7: What distinguishes a zero-day vulnerability from other security vulnerabilities?
- It targets only legacy operating systems
- No patch or fix is publicly available at the time of exploitation (Correct answer)
- It requires physical access to exploit
- It only affects web applications
Correct answer: No patch or fix is publicly available at the time of exploitation
A zero-day vulnerability is one that is exploited before the vendor has released a patch, giving defenders zero days to protect themselves.
CompTIA Network+ Network+ Network Security 2
Which attack sends unsolicited ARP replies to poison a host's ARP cache and redirect traffic?